How To Generate Let’s Encrypt SSL Certificates on Linux

How to install Let’s Encrypt on Linux?. In today’s guide I would like to show you the easiest and quickest way to install Let’s Encrypt on Linux. The process involve few steps and is really automated. The aim here is to use certbot bootstrap script by EFF to request for SSL certificate for your website from Let’s Encrypt.

Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt-an open certificate authority launched by the EFF, Mozilla, and others and deploys it to a web server.

Below are the steps to follow:

Download certbot tool

Use the commands below to download certbot on your system:

# Ubuntu / Debian
sudo apt update
sudo apt install certbot python3-certbot-apache python3-certbot-nginx

# Fedora
sudo dnf install certbot python3-certbot-nginx python3-certbot-apache

# CentOS 8
sudo dnf -y install epel-release
sudo dnf -y install certbot python3-certbot-nginx python3-certbot-apache

# CentOS 7
sudo yum -y install epel-release
sudo yum -y install certbot python3-certbot-nginx python3-certbot-apache

Before you can request for ssl certificate, open port 443 on firewall, This demonstration assumes you are running CentOS 7.x whose firewall system is firewalld. If you have other systems like Ubuntu or Debian, firewall system might be different.

sudo firewall-cmd --add-service={http,https} --permanent
sudo firewall-cmd --reload

Generate Let’s Encrypt SSL Certificates

We are going to consider two methods.

1. Using Apache / Nginx plugin

If you are using Nginx or Apache web server with configured Virtual Hosts, then you can use this method which is simpler than the manual process.

Nginx

export DOMAIN="example.com"
export ALERTS_EMAIL="[email protected]"
sudo certbot --nginx --redirect -d $DOMAIN --preferred-challenges http --agree-tos -n -m $ALERTS_EMAIL --keep-until-expiring

Apache:

export DOMAIN="example.com"
export ALERTS_EMAIL="[email protected]"
sudo certbot --apache --redirect -d $DOMAIN --preferred-challenges http --agree-tos -n -m $ALERTS_EMAIL --keep-until-expiring

This will read your web domain configuration files in /etc/nginx and /etc/apache2/ or /etc/httpd and modify by injecting SSL parameters.

2. Manual Let’s Encrypt Certificates generation

You may need to stop web server before generating SSL:

### Apache ###
sudo systemctl stop apache2 #Debian / Ubuntu
sudo systemctl stop httpd #RHEL based

### Nginx ###
sudo systemctl stop nginx

Now request for ssl certificate:

sudo certbot certonly -d  mydomain.com -d www.mydomain.com

As you make first request, the script will install required packages/dependencies and setup virtual environment.

Note that you need active dns A record for the domain specified. For www.mydomain.com, this can be a CNAME record.

Answer few questions on the prompt and in no a time you have your ssl certificate and private key. Default location for this is: /etc/letsencrypt/live

Renewing certs

sudo certbot  --renew

Automated renewal using –pre-hook and –post-hook

### For nginx ###
sudo /usr/bin/certbot renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"

### For apache ###
sudo /usr/bin/certbot renew --pre-hook "systemctl stop apache2" --post-hook "systemctl start apache2"

To force manual renewal:

sudo certbot renew --force-renewal

If you would like to use cron jobs, your crontab should have a line similar to one below;

15 3 * * * /usr/bin/certbot renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx nginx"

More on Let’s encrypt:

• Secure FreeIPA Server With Let’s Encrypt SSL Certificate
• Secure Taiga Project Management Platform with Let’s Encrypt SSL